move ct length check into decrypt function, address review comments